A/HRC/27/37 relation to digital communications infrastructure, wherever found, for example, through direct tapping or penetration of that infrastructure. Equally, where the State exercises regulatory jurisdiction over a third party that physically controls the data, that State also would have obligations under the Covenant. If a country seeks to assert jurisdiction over the data of private companies as a result of the incorporation of those companies in that country, then human rights protections must be extended to those whose privacy is being interfered with, whether in the country of incorporation or beyond. This holds whether or not such an exercise of jurisdiction is lawful in the first place, or in fact violates another State’s sovereignty. 35. This conclusion is equally important in the light of ongoing discussions on whether “foreigners” and “citizens” should have equal access to privacy protections within national security surveillance oversight regimes. Several legal regimes distinguish between the obligations owed to nationals or those within a State’s territories, and non-nationals and those outside,30 or otherwise provide foreign or external communications with lower levels of protection. If there is uncertainty around whether data are foreign or domestic, intelligence agencies will often treat the data as foreign (since digital communications regularly pass “off-shore” at some point) and thus allow them to be collected and retained. The result is significantly weaker – or even non-existent – privacy protection for foreigners and non-citizens, as compared with those of citizens. 36. International human rights law is explicit with regard to the principle of nondiscrimination. Article 26 of the International Covenant on Civil and Political Rights provides that “all persons are equal before the law and are entitled without any discrimination to the equal protection of the law” and, further, that “in this respect, the law shall prohibit any discrimination and guarantee to all persons equal and effective protection against discrimination on any ground such as race, colour, sex, language, religion, political or other opinion, national or social origin, property, birth or other status.” These provisions are to be read together with articles 17, which provides that “no one shall be subjected to arbitrary interference with his privacy” and that “everyone has the right to the protection of the law against such interference or attacks”, as well as with article 2, paragraph 1. In this regard, the Human Rights Committee has underscored the importance of “measures to ensure that any interference with the right to privacy complies with the principles of legality, proportionality and necessity regardless of the nationality or location of individuals whose communications are under direct surveillance.”31 D. Procedural safeguards and effective oversight 37. Article 17, paragraph 2 of the International Covenant on Civil and Political Rights states that everyone has the right to the protection of the law against unlawful or arbitrary interference or attacks. The “protection of the law” must be given life through effective procedural safeguards, including effective, adequately resourced institutional arrangements. It is clear, however, that a lack of effective oversight has contributed to a lack of accountability for arbitrary or unlawful intrusions on the right to privacy in the digital environment. Internal safeguards without independent, external monitoring in particular have proven ineffective against unlawful or arbitrary surveillance methods. While these safeguards may take a variety of forms, the involvement of all branches of government in 30 31 12 See for example, in the United States, the Foreign Intelligence Surveillance Act S1881(a); in the United Kingdom, the Regulation of Investigatory Powers Act 2000, s8(4); in New Zealand, the Government Security Bureau Act 2003, s. 15A; in Australia, the Intelligence Services Act S. 9; and in Canada, the National Defence Act, S. 273.64 (1). CCPR /C/USA/CO/4, para. 22.